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DETAILED ACTION 
Drawings 

1 . The drawings are objected to as failing to comply with 37 CFR 1 .84(p)(5) 
because they include the following reference character(s) not mentioned in the 
description: 144 (Figure 1), 355 (Figure 3). Corrected drawing sheets in compliance 
with 37 CFR 1.121(d), or amendment to the specification to add the reference 
character(s) in the description in compliance with 37 CFR 1.121(b) are required in reply 
to the Office action to avoid abandonment of the application. Any amended replacement 
drawing sheet should include all of the figures appearing on the immediate prior version 
of the sheet, even if only one figure is being amended. Each drawing sheet submitted 
after the filing date of an application must be labeled in the top margin as either 
"Replacement Sheet" or "New Sheet" pursuant to 37 CFR 1 .121(d). If the changes are 
not accepted by the examiner, the applicant will be notified and informed of any required 
corrective action in the next Office action. The objection to the drawings will not be held 
in abeyance. 

Specification 

2. The disclosure is objected to because of the following informalities: "146" (page 
8, line 25, perhaps 144 was intended). Appropriate correction is required. 
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Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

4. Claims 1-6 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Mitty et al. (US Patent Number: 6,199,052). 

Regarding claim 1 , Mitty et al. teach receiving the email message in a first 
encrypted format (column 12, lines 32-67, column 18, lines 8-38); decrypting the email 
message from the first encrypted format (column 12, lines 32-67, column 18, lines 8- 
38). Mitty et al. also teach transferring an email message to a trusted intermediary 
(remote server) for validation (column 12, lines 32-67, column 18, lines 8-38). Mitty et al. 
do not disclose expressly transferring the decrypted email message to a remote server 
for validation and receiving a status flag from the remote server indicating if the 
message was validated by the remote server. However, Examiner takes Official Notice 
that the use of status flags to indicate status was conventional and well known. 
Therefore, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to use a status flag to indicate the status of an operation since 
Examiner takes Official Notice that it was conventional and well known. 

Regarding claim 2, Mitty et al. teach encrypting the email message in a second 
encrypted format before transferring the email message to the remote server (column 
11, lines 55-67, column 12, lines 1-26, column 18, lines 8-38). 
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Regarding claim 3, Mitty et al. do not expressly disclose accessing the email 
message for use, if the value of the status flag indicates the remote server validated the 
email message. However, Examiner takes Official Notice that the use of status flags to 
indicate status and to access data based on the status of a flag was conventional and 
well known. Therefore, it would have been obvious to one having ordinary skill in the art 
at the time the invention was made to use a status flag to indicate the status of an 
operation since Examiner takes Official Notice that it was conventional and well known. 

Regarding claim 4, Mitty et al. teach wherein in transferring the email message, 
the first encrypted format is a Secure Multi-purpose Internet Mail Extension (S/MIME) 
format (columns 11-12). 

Regarding claim 5, Mitty et al. do not disclose expressly wherein in receiving the 
status flag, if the value of the status flag indicates the remote server validated the email 
message, then subsequent accesses made to the email message do not result in the 
email message being transferred to the remote server for validation. However, 
Examiner takes Official Notice that avoiding unnecessary re-authentication based on 
the value or existence of a flag was conventional and well known. Therefore, it would 
have been obvious to one having ordinary skill in the art at the time the invention was 
made to allow access to data for which a status flag exists and has a value indicative of 
valid data, without further re-authentication since Examiner takes Official Notice that it 
was conventional and well known. 
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Regarding claim 6, Mitty et al. teach wherein in transferring the email message, 
the email message is streamed to the remote server (column 17, lines 15-40, as it is 
part of the formal definition for a S/MIME type email). 

5. Claims 7-26 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Mitty et al., and further in view of Radatti et al. (US Publication Number: 
2002/0129237). 

Regarding claim 7, Mitty et al. teach a method to validate a data message, 
comprising: receiving the data message from a client (column 9, lines 51-67, column 10, 
lines 1-67, column 18, lines 8-38). Mitty et al. does not disclose expressly scanning the 
data message for viruses or sending a validation flag to the client, wherein the validation 
flag includes a value indicating whether the data message includes zero or more of the 
viruses. However, Radatti et al. teach scanning a message for viruses (page 1, 
paragraphs 5, 10-11). Therefore, it would have been obvious to one having ordinary skill 
in the art at the time the invention was made to scan the content of the email message 
for viruses. One of ordinary skill in the art would have been motivated to do so because 
it was well known in the art at the time the invention was made to scan email messages 
for viruses. Furthermore, Examiner takes Official Notice that the use of status flags to 
indicate status was conventional and well known. Therefore, it would have been obvious 
to one having ordinary skill in the art at the time the invention was made to use a status 
flag to indicate the status of an operation since Examiner takes Official Notice that it 
was conventional and well known. 
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Regarding claim 8, the combination of Mitty et al. and Radatti et al. teaches the 
limitations as set forth under claim 7 above. Furthermore, Radatti et al. teach decrypting 
the data message before scanning the data message (page 2, paragraphs-27-28). 
Therefore, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to decrypt the data message before scanning the data 
message. One of ordinary skill in the art would have been motivated to do so because it 
provides a way to review encrypted code (Radatti et al., page 1, paragraph 5). 

Regarding claim 9, the combination of Mitty et al. and Radatti et al. teaches the 
limitations as set forth under claim 8 above. Furthermore, Mitty et al. teach the use of 
Public Key Encryption (column 11, lines 55-67, column 12, lines 1-25). 

Regarding claim 10, the combination of Mitty et al. and Radatti et al. teaches the 
limitations as set forth under claim 7 above. Furthermore, Mitty et al. teach wherein in 
receiving the data message, the data message is an email message and the client is an 
email client (columns 12-13). 

Regarding claim 1 1 , the combination of Mitty et al. and Radatti et al. does not 
expressly disclose wherein in receiving the data message, the data message is 
received from an operating system residing on the client. However, Examiner takes 
Official Notice that it was well known in the art that the operating system as controlling a 
computer system resources, forwards messages to applications. Therefore, it would 
have been obvious to one having ordinary skill in the art at the time the invention was 
made to have the operating system forward messages since Examiner takes Official 
Notice that it was conventional and well known. 
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Regarding claim 12, the combination of Mitty et al. and Radatti et al. teaches the 
limitations as set forth under claim 7 above. Furthermore, Radatti et al. teach scanning 
a message for viruses (page 1, paragraphs 5, 10-11). Therefore, it would have been 
obvious to one having ordinary skill in the art at the time the invention was made to 
selectively scan the data message for viruses. One of ordinary skill in the art would 
have been motivated to do so because it was well known in the art at the time the 
invention was made to scan data messages for viruses. 

Regarding claim 13, the combination of Mitty et al. and Radatti et al. teaches the 
limitations as set forth under claim 7 above. Furthermore, Mitty et al. teach wherein in 
receiving the data message, the data message is received as a data stream from the 
client and scanned as the data stream is received (column 17, lines 15-40, as it is part 
of the formal definition for a S/MIME type email). 

Regarding claim 14, Mitty et al. teach an email system to validate an email 
message, comprising: a local email set of executable instructions residing on a client 
(the Exemplary Receiver, columns 12-13); a remote validation set of executable 
instructions residing on a server (the Trusted Intermediary, columns 9-11); wherein the 
email message is received by the local email set of executable instructions, decrypted 
(columns 12-13). Mitty et al. do not disclose expressly wherein the email message is 
streamed by the local email set of executable instructions to the remote validation set of 
executable instructions wherein the email message is scanned, but teach remotely 
scanning the message (the Trusted Intermediary, columns 9-11) and that some of this 
logic may be re-distributed (column 18, lines 8-38). Therefore, it would have been 
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obvious to one having ordinary skill in the art at the time the invention was made to 
have the local email set of executable instructions stream the decrypted message to the 
remote server for validation. Examiner takes Official Notice that the use of 
status/validation flags to indicate status was conventional and well known. Therefore, it 
would have been obvious to one having ordinary skill in the art at the time the invention 
was made to use a status flag to indicate the status of a scan operation since Examiner 
takes Official Notice that it was conventional and well known. 

Regarding claim 15, the combination of Mitty et al. and Radatti et al. does not 
expressly disclose wherein the local email set of executable instructions accesses the 
email message if the result indicates the scan validated the email message. However, 
Examiner takes Official Notice that to access data messages based on the result of an 
operation was conventional and well known. Therefore, it would have been obvious to 
one having ordinary skill in the art at the time the invention was made to permit access 
to data if an operation returns a valid result since Examiner takes Official Notice that it 
was conventional and well known. 

Regarding claim 16, the combination of Mitty et al. and Radatti et al. teaches the 
limitations as set forth under claim 14 above. Furthermore, Radatti et al. teach scanning 
a message for viruses (page 1 , paragraphs 5, 10-11). Therefore, it would have been 
obvious to one having ordinary skill in the art at the time the invention was made to scan 
the content of the email message for viruses. One of ordinary skill in the art would have 
been motivated to do so because it was well known in the art at the time the invention 
was made to scan email messages for viruses. 
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Regarding claim 17, the combination of Mitty et al. and Radatti et al. teaches the 
limitations as set forth under claim 14 above. Furthermore, Radatti et al. teach wherein 
the local email set of executable instructions removes the data message if the result 
indicates the scan did not validate the email message (page 2, paragraph 24). 
Therefore, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to remove a message if it is determined that it contains viruses. 
One of ordinary skill in the art would have been motivated to do so because it was well 
known in the art at the time the invention was made to remove or quarantining 
messages containing viruses. 

Regarding claim 18, the combination of Mitty et al. and Radatti et al. teaches the 
limitations as set forth under claim 14 above. Furthermore, Mitty et al. teach wherein 
communications between the local email set of executable instructions and the remote 
validation set of executable instructions are secure (columns 1-2, column 11, lines 55- 
67, column 12, lines 1-25). 

Regarding claim 19, the combination of Mitty et al. and Radatti et al. teaches the 
limitations as set forth under claim 18 above. Furthermore, Mitty et al. teach wherein 
public and private key pairs associated with the client and the server are used to 
encrypt and authenticate the communications (column 11, lines 55-67, column 12, lines 
1-25). 

Regarding claim 20, the combination of Mitty et al. and Radatti et al. teaches the 
limitations as set forth under claim 14 above. Furthermore, Mitty et al. teach wherein the 
email message includes an attachment message (column 8, lines 14-20) and wherein 
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the email message is in a Secure Multi-purpose Internet Mail Extension (S/MIME) 
format when received by the local email set of executable instructions (columns 1 1-12). 

Regarding claim 21, Mitty et al. teach a first encrypted format associated with 
content data of the email message, wherein an email client decrypts the first encrypted 
format to render the content data (column 12, lines 32-67, column 18, lines 8-38); and a 
second encrypted format associated with the content data, wherein the email client 
generates the second encrypted format, and wherein the email client transfers the 
second encrypted format to a remote server where the content data is rendered by the 
remote server by decrypting the second encrypted format (column 12, lines 32-67, 
column 18, lines 8-38). Mitty et al. does not disclose expressly wherein the remote 
server scans the content data for viruses. However, Radatti et al. teach a virus scanner 
(page 1, paragraphs 5, 10-11). Therefore, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to scan the content of the 
email message for viruses. One of ordinary skill in the art would have been motivated to 
do so because it was well known in the art at the time the invention was made to scan 
email messages for viruses. 

Regarding claim 22, the combination of Mitty et al. and Radatti et al. does not 
expressly disclose wherein a validation flag indicating whether zero or more of the 
viruses are detected in the content data is generated by the remote server and sent to 
the email client. However, Examiner takes Official Notice that the use of status flags to 
indicate status and to access data based on the status of a flag was conventional and 
well known. Therefore, it would have been obvious to one having ordinary skill in the art 
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at the time the invention was made to use a status flag to indicate the status of an 
operation since Examiner takes Official Notice that it was conventional and well known. 

Regarding claim 23, the combination of Mitty et al. and Radatti et al. teaches the 
limitations as set forth under claim 21 above. Furthermore, Mitty et al. teach wherein the 
first encrypted format is a Secure Multi-Purpose Internet Mail Extension (S/MIME) 
format (columns 11-12). 

Regarding claim 24, the combination of Mitty et al. and Radatti et al. does not 
disclose expressly wherein the second encrypted format is generated by using a private 
key for the email client and a public key for the remote server. Mitty et al. teach using 
the recipient's public key and RSA-encryption and the combination of symmetrically- 
encrypted contents and publicly-encrypted key are combined to form the envelopedData 
structure (column 11, lines 55-67, column 12, lines 1-25). Therefore, it would have been 
obvious to one having ordinary skill in the art at the time the invention was made to 
encrypt data by using a private key for a sender and a public key a remote server. One 
of ordinary skill in the art would have been motivated to do so because it was well 
known in the art at the time the invention was made to use Public Key Cryptography to 
encrypt email messages. 

Regarding claim 25, the combination of Mitty et al. and Radatti et al. does not 
expressly disclose wherein the email client accesses the content data for use when the 
remote server detects no viruses. However, Examiner takes Official Notice that the use 
of status flags to indicate status and to access data based on the status of a flag was 
conventional and well known. Therefore, it would have been obvious to one having 
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ordinary skill in the art at the time the invention was made to accesses the content data 
when no viruses are detected since Examiner takes Official Notice that it was 
conventional and well known. 

Regarding claim 26, the combination of Mitty et al. and Radatti et al. teaches the 
limitations as set forth under claim 21 above. Furthermore, Mitty et al. teach wherein the 
content data includes text data and attachment data (column 8, lines 14-20). 
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Conclusion 



6. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to David G. Cervetti whose telephone number is (571) 272- 
5861 . The examiner can normally be reached on Monday-Friday 7:00 am - 5:00 pm, off 
on Wednesday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz R. Sheikh can be reached on (571) 272-3795. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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